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Abstract 

It is well known that the repeated square and multiply algorithm 
is an efficient way of modular exponentiation. The obvious question 
to ask is if this algorithm has an inverse which would calculate the 
discrete logarithm and what is its time compexity. The technical hitch 
is in fixing the right sign of the square root and this is the heart of the 
discrete logarithm problem over finite fields of characteristic not equal 
to 2. In this paper a couple of probabilistic algorithms to compute the 
discrete logarithm over finite fields and their time complexity are given 
by bypassing this difficulty. One of the algorithms was inspired by the 
famous 3x + 1 problem. 

Key words. Discrete logarithm, Legendre symbol, 3x+l problem. 
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1 Introduction 



Let p be an odd prime number and let a be a primitive root. Then any 
b £ (Z/pZ)* can be expressed as 

b = a n mod p (1) 

for a unique integer n with 1 < n < p — 1. nis called the index or discrete 
logarithm of b to the base a modulo p. The discrete logarithm problem 
over prime fields is to find n given a and b modulo p. When p is suf- 
ficiently large and random, the discrete logarithm problem is believed to 
be computationally difficult and hence is the basis of the security of many 
cryptographic algorithms like the Diffie - Hellman key exchange protocol, El 
Gamal Cryptosystem, El Gamal signature scheme etc. The well known algo- 
rithms to compute the discrete logarithm problem are the baby step - giant 
step method, Pollard's rho method, Pohlig - Hellman method and the index 
calculus method [T], [2], [3J, [3]. In this the first two algorithms are square 
root algorithms and the Pohlig - Hellman method works efficiently for those 
primes p for which all the prime factors of p — 1 are small. The index calcu- 
lus method is a subexponential time algorithm. All these algorithms find n 
modulo p — 1. There is an analysis of the discrete logarithm problem using p- 
adic methods in [5] . In [6] , a straightforward formula for solving the discrete 
logarithm problem in certain cases is obtained using the Fermat quotient and 
its generalizations. For an extensive bibliography on this problem look at 
the website |http : //www . cs . uwaterloo . ca/~shallit/bib/dlog . bib[ The 
Pohlig-Hellman reduction is not itself a method to solve the discrete log- 
arithm problem, it reduces the problem to a number of discrete logarithm 
problems in groups of prime order. So in practice one first applies the 
Pohlig-Hellman reduction and then for example the Pollard- p- method. So 
far, there have been no known polynomial time algorithm to compute the 
discrete logarithm for a random prime p. 

We know that the modular exponentiation a n mod p (= b) in ([I]) is 
performed efficiently using the repeated square and multiply algorithm. In 
this paper we ask the question of what is the inverse of this algorithm and 
how much time does it take. As an answer to this question we give a couple of 
probabilistic algorithms that compute the discrete logarithm. The Legendre 
symbol of b determines the least significant bit (l.s.b.) of n which is the 
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index of b to the base a in ([I]). When the l.s.b. of n is 0, the next least 
significant bit of n is obtained by extracting the 'correct' square root. The 
last r significant bits can be unambiguously and efficiently determined, if 
p — 1 = 2 r s, where s is odd and r > 1 0. The ambiguity starts from the 
last r + 1 th significant bit onwards. 

In this paper we give two probabilistic algorithms which bypass this 
ambiguity and compute the discrete logarithm over prime fields. The first 
algorithm can be thought of as a randomized inverse of the repeated square 
and multiply algorithm. The second algorithm was inspired by the famous 
3x + 1 problem. The algorithms are immediately extendable to other finite 
fields (including finite fields of characteristic 2 with a slight modification). 
In Section [2] we explain how the properties of the Legendre symbol can be 
used to determine the last r significant bits of the index n and also give 
a time estimate for computing square roots modulo p. In Section [3] we 
state our main algorithm and give numerical examples over a prime field. 
A modification of the algorithm for finite fields of characteristic 2 is also 
given along with a couple of examples. This algorithm is extendable to the 
elliptic curve discrete logarithm problem. In Section [J] we state the 3x + 1 
problem and a variant of the algorithm given in Section [3] is presented with 
an example. In Section [5] we analyze the time complexity of the algorithms. 

2 The Legendre Symbol and Square Roots 

The Legendre symbol for any integer x, with (x,p) = 1 is defined as 
follows. 



The definition ([2]) of Legendre symbol can be restated as follows. ( ~J = 1, 
if x is a quadratic residue (that is, a square) modulo p and is equal to — 1, 
if x is a quadratic non-residue (that is, a non-square) modulo p. Since a is 
a primitive root, 





Using the property of the Legendre symbol 




(3) 




(4) 
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one has 

'») = (£) = (£)" = (-!).. (5) 

Thus the Legendre symbol of b determines whether n is odd or even. In 
other words, the Legendre symbol of b determines the least significant bit of 
n. Let us write n in its binary representation 

n = n + 2m + 2 2 n 2 + • • • + 2 k n k , (6) 

where each rtj is or 1. If n is even (or odd), then no = (or 1). The next 
bit n\ is determined by dividing n (or n — 1) by 2 and checking whether ^ 
(or S^ 1 - ) is even or odd. In terms of a and b modulo p, this amounts to 
finding the 'correct' square root of b (or ~) modulo p. 

Let us assume that b is a quadratic residue modulo p. Then the square 
roots of b are 62 and —62 and hence from ([3]), the index of the square roots 
to the base a are S and + ^ modulo p — 1. If p = 1 mod 4, then the 
l.s.b. of 2=i is 0. Hence the l.s.b. of §= the l.s.b. of ^ + §. In other 
words, the Legendre symbol of 62 or —62 will determine the value of the bit 
ni unambiguously. More generally, if p— 1 = 2 r s, where s is odd and r > 1, 
then the last r significant bits of n can be unambiguously determined. See 
for example [7]. The difficulty arises from the (r + l) th least significant bit 
onwards. 

Let us explain this with the case of r = 1. In this case p = 3 mod 4. 
Hence the l.s.b. of is 1. Now, if the l.s.b. of w = 1, then the l.s.b. of 

+ l| = and vice versa. Thus it is not possible to determine the correct 
value of the bit n\. In the next section we give our main algorithm which 
bypasses this difficulty. 

Note that the Legendre symbol can be calculated in polynomial time 
(0(log 2 p)) pQ. If p = 3 mod 4, then r = 1, and in this case the square roots 

s+l s+1 

of a quadratic residue x are x 2 mod p and —x 2 mod p. Hence the square 
root can be calculated in polynomial time (0(log 3 p)). If p = 1 mod 4, then 
there is a polynomial time algorithm (0(log 4 p)) to compute a square root of 
a quadratic residue, provided we could find a quadratic nonresidue modulo 
P (CQ) [!])• Since a is a primitive root, it is a quadratic nonresidue and 
hence the square roots of a quadratic residue x modulo p can be calculated 
deterministically in polynomial time. 
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3 The Repeated Square and Multiply Algorithm 
and Its Inverse 



In this section we give our main algorithm. In Section 13,11 we explain how 
modular exponentiation is done using the repeated square and multiply al- 
gorithm and describe the difficulty in trying to invert the process. In Section 
I3,2l we give our main algorithm for computing the discrete logarithm. Section 
13.31 explains the algorithm and Section 13.41 gives two examples. In Section 
13.51 we generalize the algorithm to all finite fields including finite fields of 
characteristic 2. This section also contains examples of computing discrete 
logarithm over finite fields of characteristic 2. Finally, Section 13.61 contains 
a note on the elliptic curve discrete logarithm problem over binary fields. 

3.1 Modular Exponentiation and its Inverse 

The repeated square and multiply algorithm is used to compute modular 
exponentiation in polynomial time. Let us quickly recall how we compute 
b given a, n and p as in (1) using this algorithm. If n has the binary 
representation as in ©, then let ao = a, 6o = 1 and inductively compute 
aj = a|_i mod p and bj = bj-i.dj mod p, if rij = 1 and bj = bj-%, if rij = 0, 
for j = 1 to k. Then bf. is the value of a n mod p. That is, 

r n I 1 k i \™ fe / 2 1 i \ ni / 2° i \ n ° i /„\ 

b = a = I a mod p J •••la mod pi la mod pi mod p. (7) 

It is clear that the inverse of this algorithm is to divide and repeatedly ex- 
tract square root. Division is done when the bit rij is 1, just as multiplication 
is done in the repeated square and multiply algorithm when rij is 1. Note 
that knowing the bits rij's is equivalent to knowing the value of n. Also, if 
the 'correct' square root can be taken every time, it will fix the correct value 
of the bit rij and hence n can be calculated in polynomial time. But the 
difficulty is in fixing the correct square root. We know from Section [2] that 
the last r significant bits rij can be unambiguously determined in polyno- 
mial time by dividing by a if the Legendre symbol is — 1 and extract any one 
square root or by just extracting any one square root if the Legendre symbol 
is 1. From the last r + 1 th significant bit onwards, we do not know which is 
the right bit. Now we give our probabilistic algorithm which bypasses this 
problem. 
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3.2 Algorithm to Compute Discrete Logarithm 
Input: a, b, p, where a n = b mod p . 

Output: n 

Step 1. Choose an integer B and create Table I consisting of (a kj mod p, 
kj) where j < B. Here {kj} is any subsequence of integers. For example, 
kj = j or kj = 2 3 . 

Step 2. Initialize i <— 1, k <— 0, Z <— 1 and m <— n, fe[l] <— 6, mi[l] <— n, 
ci[l] <— 6, C2[l] <— 6 and 7712(1] <— n. 

Step 3. i) If (J) = -1 then goto Step 4. 

ii) If (JJ = 1 then goto Step 6. 

Step 4. i) b <— | mod p and m <— m — 1. 
ii) Goto Step 5. 

iii) If Step 5 does not solve for n, i <— i + 1. 

store <— 6 and mi[i] ^min Table II. 

iv) Goto Step 6. 

Step 5. i) If b = a kj mod p for any j < B in Table I, Solve(m, kj,k). 

ii) If 6 = b[j] mod p for any j in Table II, Solve(m, mi [j],k). 
iii) If 6 = ci[j] or C2[j] mod p for any j in Table III, Solve(m, rri2[j], k). 

Step 6. i) b <— 62 mod p and m <— ^. fc <— fc + 1. Goto Step 5. 

ii) If Step 5 does not solve for n, b <— p — 6 mod p. Goto Step 5. 
iii) If Step 5 does not solve for n, Z <— Z + 1, 

store ci[Z] <— 6, C2 [Z] <— p — b and m2[Z] <— m in Table III. 
iv) b <— ci [Z] or C2 [Z] randomly. 

v) Goto Step 3. 

Solve() 

Solve(x, y, t): Solve the linear congruence: 

2 f x = 2 l y mod p - 1 . (8) 

Return n 
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3.3 Explanation of the Algorithm 

Table I consists of B precomputed powers of a and the corresponding discrete 
logarithms. Table II consists of intermediate values of b and the correspond- 
ing values of m as a function of n when the Legendre symbol is -1. Table 
III consists of the intermediate values of b which are square roots and the 
corresponding values of m as a function of n when the Legendre symbol is 
1. Since m is replaced by m — 1 or y, m is always a linear function of n. 
The algorithm is probabilistic as we select one of the square roots randomly 
in Step 6. 

The final step is to solve a linear congruence modulo p — 1, if the new 
value of b matches any of the integers in Table I, II or III. If b matches a 
value in Table I, then x will be a linear function of n and y will be a constant. 
In other cases, both x and y will be linear functions of n. Note that a linear 
congruence can be solved in polynomial time. 

When b coincides with a value in Table I, the value of n can be uniquely 
obtained by solving the linear congruence. 

When b coincides with a value in Table II or III, then the corresponding 
value of n can be got modulo (^p), for a divisor d of p — 1. Hence there 
will be d solutions modulo p — 1 and we have to choose the correct value 
of n modulo p — 1 by trial and error. If d is too big, then one can start 
the algorithm again from somewhere in the middle of the tree where we can 
choose the other square root. 

k counts the number of times we take square roots modulo p. Note that 
while solving the linear congruence, we multiply both sides by 2 fc , so that 
the denominator of m gets cleared (as 2 is not invertible modulo p — 1.) 
This also takes care of the fact that in Table III, though we store two square 
roots, the exponent m is taken to be y, as whether we take ?p or ^ + 
in SolveQ, multiplication by 2 k would remove this ambiguity. 

3.4 Examples 

In this section we explain the algorithm in Section 13.21 with a small prime. 
Let p = 103. a = 5 is a primitive root of p. 

Example 1. This is an example of collision with an element in Table I. Let 
b = 84. Let B = 7 and kj = 2^~ l mod p for j = 1, • • • 7. 

Table I 
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1 


2 


3 


4 


5 


6 


h v mod 103 


5 


25 


7 


49 


32 


97 


36 



Discrete Logarithm Calculation for b = 84 



b 


(ios) 


* mod 103 

a 


62 , — 62 mod 103 


random 
sqrt 


m 


84 


-1 


58 






n — 1 


58 


1 




26,77 


77 


n— 1 
2 


77 


-1 


36 






rt— 1 -1 
2 1 



Since 36 = 5 mod 103 and k = 1 as we have taken square root only once, 
after multiplying both sides by 2 we get the congruence 

n - 3 = 2 7 mod 102 (9) 

and thus n = 29 mod 102. 

Note that the binary digits of 29 are given by (11101). Comparing 
these bits and the second column of the above table, we find that we have 
wrongly chosen the square root 77 in the second row, yet we are lucky to 
find the discrete logarithm at the third step itself, while if we had taken the 
correct path, it would have taken us 6 steps. There is a trading off between 
extraction of square roots and the precomputation of powers of a. 

Note that Table II in the algorithm corresponds to third and sixth 
columns of the above table and Table III corresponds to fourth and sixth 
columns. 

Example 2. This example gives a collision in Table II or III. 



Discrete Logarithm Calculation for b = 99 



b 


(103) 


* mod 103 

a 


62 , — 62 mod 103 


random 
sqrt 


m 


99 


-1 


61 






n — 1 


61 


1 




24,79 


24 


i(n-l) 


24 


-1 


46 






i(n-3) 
|(n-3) 


46 


1 




47,56 


56 


56 


1 




46,57 




i(n-3) 



Note that 46 in the fourth column matches the 46 in the third column. 
Equating the corresponding values of m, multiplying both sides by 2 3 gives 

n-3 = 4(n-3) mod 102. (10) 
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Solving the linear congruence gives n = 3 mod 34. Hence there are 3 possible 
values for n mod 102, namely, 3, 37 and 71. One can easily check that 37 is 
the correct value of n. 

3.5 Discrete Logarithm over Finite Fields 

It is clear that the algorithm given in Section \3. 21 is. just as it is, extendable 
to finite fields of characteristic p > 3, as the analogue of Legendre symbol 
and efficient computation of square roots exist in these fields [8] . 

When the characteristic of the finite field is 2, every element in the field is 
a square and every element has exactly one square root. [9] gives an efficient 
algorithm for computing square roots over finite fields of characteristic 2. 
Note that if we choose a normal basis, then the square root operation reduces 
to a mere cyclic shift pQ. Hence, our algorithm in Section I3T21 can be modified 
in this case as follows. Step 3 should randomly decide whether the l.s.b. of 
m is 1 or 0. That is, 

Step 3. 0) Randomly choose a bit or 1. 

i) If the bit is 1 then goto Step 4. 
ii) If the bit is then goto Step 6. 

In Step 6, as there is only one square root, we need not perform ii) and 
Table III will consist of only c\[l] and the corresponding value of m. Also 
Step iv) should be skipped. 

To be precise, the randomness in our algorithm for p > 3 in the selection 
of the square root in iv) of Step 6 has been shifted to Step 3 where we 
randomly fix the l.s.b. of m for characteristic 2 fields. 

We give two toy examples below. 

Let us consider the finite field F 2 7 with the primitive polynomial f(x) = 
x 7 + x + 1. Thus, x is the generator of the multiplicative group F^ 7 of the 
finite field F 2 r. 

Example 1. Let us create Table I with B = 7 and kj = 2 3 for j = • • • 6. 

Let b = x 4 + x 3 + x 2 + 1. 



Table I 



j 





1 


2 


3 


4 


5 


6 


x 2J mod f{x) 


X 


x 2 


x 4 


x(x + 1) 


x 2 (x 2 + 1) 


x(x 3 + X + 1) 


x(x 3 + 1) 
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Discrete Logarithm Calculation for b = x 4 + x 3 + x 2 + 1 



b 


random 
bit 


| mod /(x) 


62 mod /(x) 


m 


x 4 + X 6 + x' 2 + 1 







x 5 + X + 1 


n 
2 


X 5 + X + 1 


1 


x 4 (x 2 + 1) 




- - 1 

2 1 


x 4 (x 2 + 1) 


1 


x 3 (x 2 + 1) 




n 
2 Z 


x 3 (x 2 + 1) 


1 


x 2 (x 2 + 1) 




n 
2 5 



From Table I, x 2 (x 2 + 1) = x 2 mod f(x). Hence, 

I - 3 = 2 4 mod 127, (11) 

which gives n = 38 mod 127. 

Example 2. Let 6 = x 6 + x 5 + x 3 + x + 1. 

Discrete Logarithm Calculation for b = x 6 + x 5 + x 3 + x + 1 



b 


random 
bit 


h - mod f{x) 


62 mod f(x) 


m 


x 6 + x 5 + x 3 + X + 1 







x y + x 5 + x 4 + x 2 + x + 1 


n 
2 


x 6 + x 5 + x 4 + x 2 + X + 1 


1 


x 6 + X 5 + x 4 + x 3 + X 




- — 1 

2 1 


X 6 + X 5 + x 4 + X 3 + X 


1 


X 5 + x 4 + X 3 + x 2 + 1 




2 Z 


x 5 + x 4 + x 3 + x 2 + 1 







x 6 + x 5 + x 3 + X + 1 


1 /n r 

2 I 2 ~ z 



The value of the original b and the square root in the fourth row are the 
same. Equating the corresponding values of m, we get 



n ^ \ (i ~ 2 ) mod 127 ' ^ 

Solving this linear congruence gives n = 41 mod 127. 

3.6 Elliptic Curve Discrete Logarithm over Binary Fields 

A natural question to ask now is if our algorithm can be extended to elliptic 
curves as well. Since there is no analogue of the Legendre symbol, it is 
not possible to extend this algorithm to elliptic curves. Note that in any 
group of odd order (written multiplicatively) every element has exactly one 
square root. So if we can calculate this square root efficiently, the modified 
algorithm of this section can be applied. When the elliptic curve is defined 
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over finite fields of characteric 2, there is an efficient algorithm for point- 
halving [10], [UJ if the cardinality of the curve is odd. Hence in this case 
we can generalize the algorithm given in Section T3.5I to compute the discrete 
logarithm on such elliptic curves. 

4 The 3x + 1 Problem and the Discrete Logarithm 
Problem 

In this section we give a variant of the main algorithm given in Section 13.21 
This was inspired by the famous 3x + 1 problem. The 3x + 1 problem which 
was posed by L. Collatz, states that if 

T(r \ _ f 327 + 1, if x = 1 mod 2 
1 [X) ~ \ f , if x = mod 2 , 

then for any positive integer x there exists an integer k > with T k (x) = 1. 
This problem remains open since 1937. For an annotated bibliography of 
this problem, see |12j . 

Note that in this problem if x is odd, the function T converts it into an 
even integer by multiplying x by 3 and then adding 1, while if x is even, 
it divides x by 2. The iteration will terminate once T k (x) = 2 l for some 
integers k and /. 

In the algorithm we gave in Section [3.21 if the Legendre symbol is — 1 
(that is, the index of b is odd), we divided b by a so that the index of the 
new value of b becomes even and if the Legendre symbol is 1, (that is, the 
index of b is even) , we calculated the square roots of b so that the index is 
halved. 

Now it is clear how we are going to modify the algorithm in Section 13.21 
We will assume for the sake of simplicity that (3,p — 1) = 1. If the Legendre 
symbol is —1, then compute 6 3 a mod p. That is, in Step 4 (i), we do 

b <— 6 3 a mod p and m <— 3m + 1 (14) 

and the rest of the algorithm goes as before. 

4.1 Example 

We explain our algorithm with an example, again with a small prime. Let 
us take p = 101. a = 2 is a primitive root of 101. Let b = 72. Let B = 7 
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and kj = 2 3 , for j = • • • 6. 



Table I 



3 





1 


2 


3 


4 


5 


6 


2 23 mod 101 


2 


4 


16 


54 


88 


68 


79 



Discrete Logarithm Calculation for b = 72 



b 








b 3 a mod 101 


62 ; — 62 mod 101 


random 
sqrt 


m 


72 
5 

56 
37 
80 


-1 
1 
1 
1 
1 


5 


45,56 
37,64 
21,80 
22,79 


56 
37 
80 


3n + 1 

3n+l 
2 

3n+l 
4 

3n+l 

3n+l 
16 



Since 79 = 2 2 mod 101, and k = 4, we have 



3n + 1 = 1024 = 24 mod 100 . (15) 
The solution of this linear congruence is given by n = 41 mod 100. 



5 Time Complexity of the Algorithms 

Let us first look at the algorithm in Section 13.51 over finite fields of charac- 
teristic 2. Here we randomly choose to do division or extract square root. 
Let p : N — > {0, 1} be the random decision function. Starting with 
ro = b = a n , we have for i £ J\f 

I y/rTZI, if p(i) = ( , 

Let Table I consist of B G precomputed values and label them r_#, r_i . 
Since we need to keep track of the exponents we store pairs of the form 
(a k , k), hence write (r_£, k-s), (f-i, fc-i), where {A;j} is the chosen sub- 
sequence of integers (as in Section 3.2). So starting with (ro,mo), mo = n, 
we calculate a random walk by 

(^^i-i - 1 , if /9U) = 1. 
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Then we look for a collision r, = rj for i ^ j. Since n is unknown, the rrii 
are linear functions in n. 

Note that in the algorithm given in Section [321 the- random function will 
decide which square root will be taken. Since we store both square roots, 
we add a control bit hi in each step where b% = 1 means a square root was 
taken (6j = means a division.) In step i, when we look for collisions of 
r.j with some previous element, we test r\ = Tj if bj = and r$ = ±r\- if 
bj = 1. (Note that if rj is one square root then — rj is the other and that 
the associated linear functions are the same.) Hence in this case, we have 

f (min(^/f~T,p- y/rm), !! ^,1), if ( I y i ) = 1 and p(i) = 
(n,mi,6i) = < (max(^/r~I,p- ^/r~T), !Ii; y J -,l), if ( I y i ) = 1 and = 1 (18) 
[ (1^,^-1,0), if (^) = -i. 

With respect to the algorithm given in Section |U only the iteration function 
is changed. Since this is a random walk, the expected number of steps 
should be about 0{yfp). In comparison with the Pollard p -method, our 
algorithms are probably slower, since taking square roots and division are 
(in general) slower than squaring and multiplication. Also, Floyd's cycle 
detection method will not apply here as the function p is a random decision 
function. On the other hand, p being a 'random decision function' gives the 
walk a random pattern. 

6 Conclusion and Future Directions 

In this paper we have asked the question of what is the inverse of repeated 
square and multiply algorithm and given a couple of probabilistic algorithms 
to compute the discrete logarithm. The algorithms are parallelizable. It is 
noted that the algorithm given for binary finite fields can also be extended to 
elliptic curves over such fields. Analysis of the algorithms shows that these 
algorithms are of square root type, like the baby step-giant step method, 
Pollard's p method etc. [13] Though the algorithm given in Section [4] does 
not 'carry the idea of the inverse of square and multiply', it will be worth- 
while to study the more general scheme x — » ax + b, with (a,p — 1) = 1, if 
x is odd, and x — > |, if x is even and see if some interesting algebra could 
be uncovered. 
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